Vulnerability advisory

GHSA-7v68-3pr5-h3cr

Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution

Published May 15, 2024Updated Nov 29, 2024OSV record ↗

Severity

Severity not reported.

Affected versions

drupal/core Packagist

Affected	Fixed in
`8.0.0` to before 8.5.8	`8.5.8`Advisories →
Also listed as affected (73) `8.0.0` `8.0.1` `8.0.2` `8.0.3` `8.0.4` `8.0.5` `8.0.6` `8.1.0` `8.1.0-beta1` `8.1.0-beta2` `8.1.0-rc1` `8.1.1` `8.1.10` `8.1.2` `8.1.3` `8.1.4` `8.1.5` `8.1.6` `8.1.7` `8.1.8` `8.1.9` `8.2.0` `8.2.0-beta1` `8.2.0-beta2` `8.2.0-beta3` `8.2.0-rc1` `8.2.0-rc2` `8.2.1` `8.2.2` `8.2.3` `8.2.4` `8.2.5` `8.2.6` `8.2.7` `8.2.8` `8.3.0` `8.3.0-alpha1` `8.3.0-beta1` `8.3.0-rc1` `8.3.0-rc2` `8.3.1` `8.3.2` `8.3.3` `8.3.4` `8.3.5` `8.3.6` `8.3.7` `8.3.8` `8.3.9` `8.4.0` `8.4.0-alpha1` `8.4.0-beta1` `8.4.0-rc1` `8.4.0-rc2` `8.4.1` `8.4.2` `8.4.3` `8.4.4` `8.4.5` `8.4.6` `8.4.7` `8.4.8` `8.5.0` `8.5.0-alpha1` `8.5.0-beta1` `8.5.0-rc1` `8.5.1` `8.5.2` `8.5.3` `8.5.4` `8.5.5` `8.5.6` `8.5.7`
`8.6.0` to before 8.6.2	`8.6.2`Advisories →
Also listed as affected (2) `8.6.0` `8.6.1`

Description

The Contextual Links module doesn't sufficiently validate the requested contextual links. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access contextual links".

GHSA-7v68-3pr5-h3cr

Affected versions

drupal/core Packagist

Description

References